Privacy Policy

1. Who we are

The Works CRM is a service operated by The Works Holdings, a privately held company based in Dubai, United Arab Emirates ("we", "us", "our"). For everything covered by this policy in relation to our own platforms, The Works Holdings is the data controller. You can reach us at lavjit@theworksholdings.com.

2. Scope

This policy governs personal data we process as controller: data about people who visit our sites, create an individual account, or set up and administer a company account. For business customers of The Works CRM, a separate role applies to the client data those customers store in the system, explained in section 12.

3. The personal data we collect

We collect only what we need to run the service:

• Account and sign-up data. Your name, email address and, for company accounts, your company name, work email domain and the number of seats you request.
• Authentication data. Login credentials and session records, handled through our authentication provider, including single-device session enforcement on licensed accounts so a seat is used by one person.
• Usage and analytics data. Page views and basic device information gathered by our own first-party analytics beacon. IP addresses are stored only as a salted hash; we do not set tracking cookies beyond those needed for authentication and session management.
• Feedback and support data. Anything you choose to send us through the voluntary feedback widget or by email.
• Learning records. For learners, course progress, test and exam results and the certificates issued to you.

4. How we use your data and our lawful basis

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), we process your data on one of the following lawful bases:

• Performance of a contract. To create and run your account, deliver courses, issue certificates, assign company seats and provide support.
• Legitimate interests. To keep the service secure, prevent misuse, understand aggregate usage through privacy-preserving analytics, and improve what we offer, in a way that does not override your rights.
• Consent. For any non-essential processing. Where we rely on consent you may withdraw it at any time without affecting processing already carried out.
• Legal obligation. Where we must process data to comply with applicable law.

We practise data minimisation: we collect the least data needed for each purpose and do not use your data for automated decisions that produce legal or similarly significant effects.

5. Cookies and analytics

We use only essential cookies required to sign you in and keep your session secure. Our analytics beacon is first-party and counts page views with salted-hashed IP addresses; it does not profile you across other sites and does not rely on non-essential tracking cookies. Where any non-essential processing is introduced, we will ask for your consent first.

6. Your rights

Subject to the conditions in the PDPL, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• request deletion of your data;
• object to, or ask us to restrict, certain processing;
• receive your data in a portable, machine-readable format and, where feasible, have it transmitted to another controller;
• withdraw consent where processing is based on consent.

To exercise any of these rights, email lavjit@theworksholdings.com. We aim to respond to every request within 14 days. If we need longer for a complex request, we will tell you why and keep you informed.

7. International visitors (EU and UK)

If you are in the European Union or the United Kingdom, we extend to you rights equivalent to those under the GDPR and UK GDPR, including access, rectification, erasure, restriction, objection and portability, and the right to lodge a complaint with your local supervisory authority. We continue to apply data minimisation and rely on consent for any non-essential processing.

8. Sharing and sub-processors

We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract and only as needed to run the service. Our current categories of sub-processor are:

• Hosting and delivery: Vercel.
• Database and authentication: Supabase.
• Email: Microsoft 365.

We may also share data where required by law or to protect our rights. If we engage further sub-processors, we will hold them to equivalent data-protection obligations.

9. International data transfers

Some of our providers process data outside the UAE. We transfer personal data across borders only where an adequate level of protection exists or where appropriate safeguards are in place, such as contractual protections that meet the requirements of the PDPL, so your data stays protected wherever it is processed.

10. Security and breach notification

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit and least-privilege access to systems. No system is ever completely secure. In the event of a personal data breach that poses a risk to your rights, we are committed to notifying the competent UAE authority and affected individuals without undue delay, in line with the PDPL.

11. Data retention

We keep your personal data for as long as your account is active, plus a defined wind-down period after closure during which the data may be recovered or exported before secure deletion or anonymisation, unless a longer period is required by law. For company customers of The Works CRM, client data stored in the system is retained and deleted according to that customer's instructions as controller (see section 12).

12. Our role for The Works CRM customers

Where The Works CRM is used by a real estate agency or other business to hold information about its own clients, that business is the data controller of the client data it enters, and we act as its data processor. The customer is responsible for having a lawful basis for the client personal data it stores and for honouring its own clients' rights. We process that data only on the customer's documented instructions and in line with the agreement between us.

13. Children

The service is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date below and, where appropriate, notify you through the service.

15. Contact and complaints

For any privacy question or to exercise your rights, contact lavjit@theworksholdings.com. If you are not satisfied with our response, you may lodge a complaint with the competent UAE data protection authority or, for EU and UK visitors, your local supervisory authority.

16. Governing law

This policy is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai. Any dispute is subject to the exclusive jurisdiction of the courts of Dubai (the DIFC courts excluded).